What Is Network Segmentation?
Network segmentation is the practice of splitting a network into smaller segments, separating groups of systems/applications from each other so unrelated things don't sit in the same broadcast/trust zone. In a segmented network, systems with no need to interact are placed in different segments — e.g. proxy/email/web servers might live in one DMZ zone, application/database servers in another, all separated from the internal user-workstation zone by a firewall.
Three Types of Network Segmentation
Physical Segmentation
Splits a larger network into smaller physical components — segments communicate via intermediary devices (switches, hubs, routers). Easy conceptually, but expensive — takes more hardware/space.
Logical Segmentation (VLANs)
Uses VLANs — isolated logically regardless of physical device location. Each VLAN acts as its own independent logical unit. Firewalls are shared while switches handle the VLAN infrastructure. Easier to implement and more flexible than physical segmentation.
Network Virtualization
Combines all available network resources so security professionals can share them across network users via a single administrative unit — a virtualization layer sits above the physical layer, letting each user access files, folders, printers, drives, etc. from their own system.
Mnemonic — "Physical costs Pipes, Logical costs Labels, Virtual costs nothing but Layers"
Physical = real cables/switches (expensive, rigid). Logical (VLAN) = just a tag/label on shared hardware (cheap, flexible). Virtualization = an abstraction layer over everything (maximally shared, single admin unit).
Bastion Hosts
A bastion host is a computer system designed and configured specifically to protect network resources from attack. It's the only host directly addressable from the public internet, and it deliberately offers a very limited set of services (e.g. website hosting, mail) to minimize its attack surface.
Why You Need a Bastion Host
- Minimizes the chances of penetration by intruders.
- Creates logs that help identify attacks or attack attempts.
- Acts as a scapegoat if an attack does succeed — sacrificing itself to protect the rest of the network.
- Provides an additional layer of security overall.
Positioning the Bastion Host
- Placed in a specially selected server room with proper environmental controls
- Set up in a locked cabinet with ventilation, cooling, backup power
- Set on a special network known as the DMZ that carries no sensitive data
- Avoid placing it on internal networks
- Should live on an additional "perimeter network" layer
- Attach a packet filtering router
Typical topology: Internet → Exterior Firewall → DMZ/Perimeter Network (with Bastion Hosts) → Interior Firewall → Intranet.
Types of Bastion Hosts
Single-homed
Has only one network interface. All incoming/outgoing traffic routes through it; tests data against security guidelines and acts accordingly.
Multi-homed
Has at least two network interfaces, letting it separate internal and external networks and improve security further.
Internal Bastion Host
Resides inside the internal network; can be single- or multi-homed; internal devices communicate with it directly.
Non-routing Dual-homed Host
Has multiple network connections, but those connections don't interact with each other — effectively keeping networks isolated even while touching both.
External Services Host
Visible to everyone (hence vulnerable), but requires only minimum access privileges to the internal network — offers just a few services.
Victim Machine
Deliberately allows any user to log in — useful for testing new applications with unknown security flaws or running insecure services in a safe sandbox.
One-box Firewall
The entire firewall is a single machine — prone to more attacks since the whole site's security rests on that one box being absolutely secure.
Mnemonic — "Single door, Multi doors"
Single-homed = one door in and out (one NIC). Multi-homed = multiple doors that don't connect to each other directly (multiple NICs, better separation). The more "homes" (interfaces) a bastion host has, the more it can act as a proper gatekeeper between zones.
Demilitarized Zone (DMZ)
A DMZ is a subnetwork placed between an organization's private network (LAN) and an outside public network (Internet), acting as an additional security buffer layer. It contains servers that need to be reachable from outside — web servers, email servers, DNS servers.
DMZ Traffic Rules
- Both internal and external networks can connect to the DMZ.
- Hosts in the DMZ can connect out to external networks.
- Hosts in the DMZ cannot connect to internal networks — this is the whole point of the buffer.
Two Ways to Build a DMZ
One firewall device with three network interfaces: Interface 1 connects to the ISP/external network, Interface 2 forms the internal network, Interface 3 forms the DMZ. Cheaper — but that single firewall is now a single point of failure for all three zones.
Uses two separate firewalls. The first (public) firewall only allows sanitized traffic into the DMZ; the second (internal) firewall double-checks it before letting anything reach the internal network. This is the most secure way to build a DMZ.
Mnemonic — "One firewall, one chance; Two firewalls, two checks"
Single-firewall DMZ = one gate guard checking everyone at once (cheaper, riskier). Dual-firewall DMZ = two separate checkpoints in a row — even if you sneak past the first, the second one catches you. That's why dual-firewall is the gold-standard, most-secure DMZ design.
What Is a Firewall?
A firewall is software, hardware, or a combination of both, generally used to separate a protected private network from an unprotected public network. It monitors and filters incoming/outgoing traffic and prevents unauthorized access — only traffic meeting specific criteria is allowed through; everything else is stopped.
Hardware vs. Software Firewalls
A dedicated stand-alone device, or built into a router. Filters traffic using packet filtering, and is typically used for large business networks.
A program installed on a computer like normal software. Filters traffic only for the machine it's installed on — not for the whole network. Best used by individual home users.
Best practice
It's recommended to configure both a hardware and a software firewall for best protection.
Host-based vs. Network-based Firewalls
Filters inbound/outbound traffic of an individual computer. Software-based, usually part of the OS. Examples: Windows Firewall, Iptables, UFW.
Filters inbound/outbound traffic for the internal LAN as a whole. Hardware-based. Examples: pfSense, Smoothwall, Cisco SonicWall, Netgear ProSafe, D-Link.
Again, it's recommended to configure both a host-based and a network-based firewall for best protection.
Firewall Technologies by OSI Layer
Firewalls come in several generations of "technology" (services), each operating at different layers and inspecting traffic with different levels of sophistication.
| OSI Layer | Firewall Technology |
|---|---|
| Application | VPN, Application Proxies |
| Presentation | VPN |
| Session | VPN, Circuit-Level Gateways |
| Transport | VPN, Packet Filtering |
| Network | VPN, NAT, Packet Filtering, Stateful Multilayer Inspection |
| Data Link | VPN, Packet Filtering |
| Physical | Not applicable |
The Core Firewall Technologies
Packet Filtering
Works at the network level (IP layer). Filters based on source/destination IP, packet type, and port number. Each packet is checked against a criteria list before forwarding. Unknown traffic is only allowed up to level 2 of the stack. Usually built into routers.
Circuit-Level Gateway
Works at the session layer (TCP). Filters based on session rules — e.g. whether a session was initiated by a recognized computer. Monitors the TCP handshake to judge legitimacy. Traffic passed through appears to originate from the gateway itself. Unknown traffic allowed up to level 3.
Application-Level Gateway
Filters at the application layer — can inspect application-specific commands (e.g. HTTP POST/GET). Can be configured as a web proxy that blocks FTP, gopher, Telnet, etc. Unknown traffic allowed all the way up to the top of the stack.
Stateful Multilayer Inspection
Combines all three: filters at network layer, checks session legitimacy, AND evaluates application-layer content. Unknown traffic allowed only up to level 2. More thorough but expensive and requires skilled administrators.
Mnemonic — "PACS: Packets, Are, Circuits, Stateful"
Packet filtering (network, cheapest, dumbest) → Application gateway (application, smartest, slowest) → Circuit-level gateway (session, middle-ground) → Stateful multilayer (all three combined, most expensive). Remember: more layers inspected = more security = more cost/complexity.
Application Proxy
An application-level proxy filters connections for specific services and protocols. Example: an FTP proxy only lets FTP traffic through, blocking every other service/protocol. Common proxied services include DNS, SMTP, FTP, HTTPS, NNTP.
Network Address Translation (NAT)
NAT separates IP addresses into two sets so a LAN can use one set internally and another externally. Works alongside a router (like packet filtering does) and modifies packets as they pass through, making them appear to originate from a valid public address. This limits the number of public IPs an organization needs to purchase.
Internal hosts at 192.168.168.1, 192.168.168.2, 192.168.168.3 sit behind a switch. NAT translates their private IPs to a single public IP (e.g. 200.0.0.45) before packets hit the internet — hiding the internal addressing scheme entirely from outsiders.
Virtual Private Network (VPN)
A VPN is a private network built using public infrastructure (like the Internet), used for secure transmission of sensitive data over an untrusted network via encapsulation and encryption. It establishes a virtual point-to-point connection through dedicated tunnels — the device running the VPN client can only access the VPN, not arbitrary other traffic.
Next Generation Firewall (NGFW)
NGFW is the third-generation firewall technology, moving beyond simple port/protocol inspection to inspect traffic based on packet content. Typical NGFW capabilities:
- Deep packet inspection (DPI)
- Encrypted traffic inspection
- QoS / bandwidth management
- Threat intelligence integration
- Integrated intrusion prevention system
- Advanced threat protection
- Application control
- Antivirus inspection
Firewall Capabilities & Limitations
- Prevent network scanning
- Control traffic
- Perform user authentication
- Filter packets, services, and protocols
- Perform traffic logging
- Perform NAT
- Prevent malware attacks
- Does not prevent backdoor attacks
- Does not protect against insider attacks
- Can't help if the network design/config is faulty
- Is NOT an alternative to antivirus/antimalware
- Does not prevent brand-new viruses
- Cannot prevent social engineering threats
- Does not prevent password misuse
- Does not block attacks from a higher level of the protocol stack (than what it inspects)
Mnemonic — "A firewall guards the gate, not the guests"
A firewall watches the front door of the network. It can't stop someone already inside (insider attacks), can't stop someone tricked into opening the door themselves (social engineering, password misuse), and can't fix a door that was built wrong (bad network design). It's a gatekeeper, not a bodyguard for every person inside.
Firewall Implementation & Deployment Process
Planning
Plan firewall positioning in advance before deploying anything.
Configuring
Configure hardware, software, policy, logging, and alerting mechanisms.
Testing
Verify firewall rules are set according to the intended actions.
Deploying
Use a phased approach across multiple firewalls to catch conflicting policies early.
Managing & Maintaining
Maintain the firewall architecture, policies, software, and other deployed components over time.
Host-based Firewall Protection with Iptables
Iptables is Linux's built-in firewall utility — pre-installed on most distros (or installable via
sudo apt-get install iptables).
| Task | Iptables Command |
|---|---|
| Filter non-TCP packets | iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP |
| Block XMAS scan attack | iptables -A INPUT -p tcp --tcp-flags ALL -j DROP |
| Drop any NULL packets | iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP |
| Drop fragmented packets | iptables -A INPUT -f -j DROP |
| Check existing rules | sudo iptables -L -n -v |
| Block a specific IP | iptables -A INPUT -s 10.10.10.55 -j DROP |
Secure Firewall Implementation: Best Practices & Recommendations
Best Practices
- Filter unused and commonly-vulnerable ports
- Limit applications running on the firewall to boost performance
- Run firewall services under a unique user ID, never root/admin
- Configure a remote syslog server, protected from malicious users
- Set the ruleset to deny all traffic by default, enable only what's required
- Monitor firewall logs regularly and include them in your data retention policy
- Use strong, non-dictionary passwords, changing all defaults
- Immediately investigate any suspicious log entries
Recommendations
- 1. Notify the security administrator of changes and document them
- 2. Do not set conflicting rules — remove them if they exist
- 3. Remove unused or outdated rules
- 4. Clean up and optimize the firewall rule base
- 5. Schedule regular firewall security audits
- 6. Keep a log of all firewall rule/configuration changes
- 7. Use a standard method and workflow for requesting/implementing changes
Do's and Don'ts
- 1. Implement a strong firewall
- 2. Limit the applications that run on a firewall
- 3. Control physical access to the firewall
- 4. Evaluate firewall capabilities
- 5. Consider workflow integration
- 6. Don't overlook scalability
- 7. Don't rely on packet filtering alone
- 8. Don't be unsympathetic to hardware needs
- 9. Don't cut back on additional security
- 10. Don't implement without SSL encryption
Mnemonic — "Deny by default, log everything, never rely on one layer"
The whole best-practices list boils down to three habits: 1) Default-deny (allow only what's explicitly needed), 2) Log & audit religiously (syslog, retention policy, regular audits), and 3) Never rely on the firewall alone (don't skip SSL, don't rely on packet filtering alone, pair with antivirus). If you remember these three habits, most of the 15+ bullet points on this slide fall out naturally.
Exam Tips & Tricks
Physical vs Logical vs Virtualization
Physical = real hardware components (expensive). Logical = VLANs (flexible, shared firewall). Virtualization = combined resources under one admin layer.
Bastion host = sacrificial gatekeeper
It's the only directly-addressable host from the internet, deliberately limited in services, and acts as a "scapegoat" if attacked.
Dual-firewall DMZ > single-firewall DMZ
Dual firewall is explicitly called out as the MOST secure DMZ design in the slides — remember the "two checkpoints" logic.
4 firewall technologies + their layers
Packet filtering (network) → Circuit-level gateway (session) → Application gateway (application) → Stateful multilayer (all three).
Firewalls ≠ antivirus
A classic exam trap: a firewall is explicitly NOT an alternative to antivirus/antimalware, and can't stop insider attacks or social engineering.
NAT hides internal addressing
NAT translates private IPs to a public IP (or pool), limiting how many public IPs an org needs and hiding internal topology.
NGFW = 3rd generation
NGFW goes beyond port/protocol filtering to inspect packet content — remember DPI, integrated IPS, and application control as hallmark NGFW features.
Iptables default-deny pattern
Common iptables tasks to memorize: filter non-TCP, block XMAS scans, drop NULL/fragmented packets, block specific IPs.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| Network Segmentation | Splitting a network into smaller segments to isolate unrelated systems. |
| Physical Segmentation | Real hardware components (switches/hubs/routers); expensive, more space. |
| Logical Segmentation | VLANs; isolated logically, shared firewall, easy/flexible. |
| Network Virtualization | Combines all network resources under a single admin layer. |
| Bastion Host | Only directly-addressable host from the internet; limited services; acts as scapegoat. |
| Single-homed Bastion | One NIC; all traffic routes through it. |
| Multi-homed Bastion | Two+ NICs; separates internal/external networks. |
| DMZ | Buffer subnetwork between private LAN and public internet; hosts web/email/DNS servers. |
| DMZ Rule | Internal & external can reach DMZ; DMZ can reach external; DMZ cannot reach internal. |
| Single Firewall DMZ | 3-interface firewall (ISP, internal, DMZ); cheaper, single point of failure. |
| Dual Firewall DMZ | Two firewalls (public + internal); most secure DMZ design. |
| Hardware Firewall | Dedicated device/router-based; used for large business networks. |
| Software Firewall | Installed program; protects only the host it's on; for home users. |
| Host-based Firewall | Protects one computer (Windows Firewall, Iptables, UFW). |
| Network-based Firewall | Protects the whole LAN (pfSense, Cisco SonicWall, etc.). |
| Packet Filtering | Network layer; filters by IP/port/protocol; part of routers. |
| Circuit-Level Gateway | Session layer; validates TCP handshake legitimacy. |
| Application-Level Gateway | Application layer; inspects app commands (HTTP GET/POST); can be a web proxy. |
| Stateful Multilayer Inspection | Combines network + session + application filtering; expensive, needs skilled admins. |
| Application Proxy | Filters connections per service/protocol (e.g. FTP-only proxy). |
| NAT | Translates private↔public IPs; hides internal addressing; limits public IP usage. |
| VPN | Encrypted point-to-point tunnel over public infrastructure. |
| NGFW | 3rd-gen firewall; inspects packet content (DPI), integrated IPS, app control. |
| Firewall Capabilities | Scanning prevention, traffic control, authentication, packet filtering, logging, NAT, malware prevention. |
| Firewall Limitations | No defense vs backdoors, insiders, bad network design, new viruses, social engineering, password misuse; not an AV substitute. |
| Implementation Process | Planning → Configuring → Testing → Deploying → Managing/Maintaining. |
| Iptables | Linux firewall utility; rules for filtering, dropping NULL/fragmented packets, blocking IPs. |
| Best Practice Core Habit | Default-deny rules, log/audit everything, never rely on the firewall alone. |